Critical PHP2Shell Vulnerabilities

On October 21st several companies began rolling updates to fix the two vulnerabilities that AI had found in PHP, which is the backbone to tens of millions of websites and server across the globe.
I will say this first to put your mind at ease if you are one of my customers; your websites infrastructure is already patched.

What is the issue?
The two critical vulnerabilities are in PHP itself (CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”). Both are rated 9.2 out of 10. They let an attacker run code on your server with a single crafted web request, with no login required.
Usually a hack uses brute-force attacks, credential stuffing, stolen passwords. Those attacks all have one thing in common. They go through your login page, which is exactly where tools like Limit Login Attempts Reloaded stand guard and help with your security.
PHP2Shell is different. It never touches the login page. An attacker doesn’t need to guess a password because they don’t need to log in at all. That means no login protection, firewall rule set or security plugin can fully close this hole for you. The only real fix is updating PHP. The PHP team has said plainly that there is no complete workaround and that updating is the only safe option.

The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI “Patch the Planet” project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. Austin used OpenAI’s GPT-5.6 Sol model to assist with finding the vulnerability. Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research

PHP2Shell is about as serious as server-side vulnerabilities get: no login required, and it affects the software underneath nearly every WordPress site.
Check your PHP version today, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer), and confirm the update actually took. Then keep your login defences strong for everything else.
I would advise installing Login Attempts Reloaded and adding 2FA to your websites as an extra measure, as stated earlier this will NOT stop this threat, but does stop all the usual attacks we get on a daily basis.

So, you must upgrade your PHP, there is no other way to stop this exploit!

Which PHP versions fix PHP2Shell?

PHP branch	First upstream security release for both CVEs	What to record
8.5	8.5.12	Serving instance and active runtime
8.4	8.4.27	Package provider and revision
8.3	8.3.36	Restart or replacement completed
8.2	8.2.35	Patch now; plan branch migration
8.1 and older	Use a verified vendor backport or migrate	Provider advisory covering both CVEs

If you are unable to patch your PHP straight away, I would strongly advise you to do some backups and then take your site offline until you can fix it!

Good luck!

UPDATE on 24/10/2026
BREAKING PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws.

New “CVE-2026-115560” affects only unusual session configurations.

PHP has issued urgent mitigation guidance.

As the PHP2Shell chaos continues, researchers have found a third PHP vulnerability that could allow attackers to take over websites or remotely run malware on vulnerable systems. But this one won’t receive an emergency fix.

The PHP Foundation on Friday said it has reserved a CVE identifier (CVE-2026-115560) for a third RCE flaw to go with the first two that comprise PHP2Shell, and it will release a full advisory and fixed software with the next regular PHP release.

CVE-2026-115560 “requires a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use of PHP,” Elizabeth Barron, executive director of the PHP Foundation, told The Register. “The issue can be mitigated with a configuration setting. So for the moment the PHP Security Team has only published an informational advisory on the PHP website, explaining exactly this situation.”

The informational advisory, published on Friday, suggests that users “set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.”